UK Subject Access Request (SAR) Letter Generator
Enter your name, the organisation you are writing to, and (optionally) what personal data you want, and this tool assembles a Subject Access Request letter citing Article 15 of the UK GDPR, ready to copy or print. It updates live as you type, everything runs in your browser, and nothing you enter is saved, sent, or emailed anywhere.
A free template, not legal advice.
This tool helps you exercise your existing legal right of access under the UK GDPR. It is not legal advice, and RecordingLaw.com is not a law firm. You send the finished letter yourself, directly to the organisation. If the organisation refuses, ignores you, or does not respond within the required time, you can complain to the Information Commissioner's Office (ICO).
Add your name and the organisation's name
The letter below fills in placeholders until both are entered.
[Your full name] [Date] [Organisation name] Subject Access Request Dear [Organisation name], I am writing to make a subject access request under Article 15 of the UK General Data Protection Regulation (UK GDPR). Please provide me with a copy of all personal data you hold about me, in whatever format it is held. Please also confirm, where applicable: the purposes for which you process my personal data; the categories of personal data concerned; anyone you have shared or will share it with, including any recipients outside the UK; how long you intend to keep it; and, if you did not collect the data directly from me, where it came from. Under Article 15 UK GDPR, you are required to respond without undue delay and within one calendar month of receiving this request. This request is made free of charge. Please confirm in writing that you have received it. If you need to verify my identity before you can act on this request, please tell me promptly what proof you need, so this does not cause unnecessary delay. If you consider any part of this request unclear, or manifestly unfounded or excessive, please contact me before refusing it or charging a fee, so I can clarify exactly what I am asking for. Yours faithfully, [Your full name]
What Happens After You Send It
A Subject Access Request (SAR) is a right under Article 15 of the UK GDPR to ask an organisation what personal data it holds about you and to get a copy of it. Once you send the letter, the organisation must respond without undue delay and within one calendar month, and the request is normally free of charge (a reasonable fee can only be charged for manifestly unfounded or excessive requests, or for extra copies).
Since 5 February 2026, the Data (Use and Access) Act 2025 (DUAA) has made two changes worth knowing about. First, an organisation only has to carry out a "reasonable and proportionate" search for your data, not an exhaustive search of every system regardless of cost. Second, the organisation can pause ("stop") the one-month clock while it is waiting for you to confirm your identity or clarify what you are asking for, then restart it once you reply. That is why this generator includes a line offering to provide proof of identity promptly, so any request for ID does not sit unanswered and cause an avoidable delay.
For the full picture on your right of access, including what counts as a valid request and how extensions for complex requests work, see the Subject Access Request guide. If the organisation misses the deadline or refuses your request without a valid reason, the guide to complaining to the ICO covers the next steps. Both sit under the UK data privacy hub.
What This Tool Does Not Do
This generator only assembles the wording of a letter from the details you type in. It does not check whether the organisation actually holds data about you, does not send anything on your behalf, does not store or transmit anything you enter, and does not tell you whether a particular request is likely to succeed. You are responsible for sending the finished letter yourself (by post or email) and for keeping a copy. For anything unusual, such as a dispute already in progress or data held by a public authority under a different access regime, consider the ICO's own guidance on the right of access or take independent legal advice.
Frequently Asked Questions
Is a UK Subject Access Request really free?
In almost all cases, yes. Under Article 15 UK GDPR, an organisation cannot charge you to respond to a Subject Access Request. It can only charge a reasonable fee if the request is manifestly unfounded or excessive (for example, repetitive requests), or for extra copies beyond the first.
How long does an organisation have to respond?
Without undue delay, and within one calendar month of receiving a valid request. This can be extended by up to two further months for particularly complex requests or where you have made a number of requests, but the organisation must tell you within the first month if it is doing this and explain why.
Can the organisation ask me for ID before responding?
Yes, if it has reasonable doubts about your identity. Since 5 February 2026, under the Data (Use and Access) Act 2025, the organisation can pause the one-month clock while it waits for you to confirm your identity or clarify the request, then restart the clock once you respond. That is why this generator includes a line inviting the organisation to tell you promptly what proof it needs.
Does the organisation have to search every single system?
Since 5 February 2026, the Data (Use and Access) Act 2025 clarifies that an organisation only needs to carry out a "reasonable and proportionate" search for your data, rather than an exhaustive search regardless of cost or effort. It should still make a genuine effort to locate data held about you across the systems it would reasonably be expected to check.
What if the organisation ignores my request or refuses it?
First, chase the organisation in writing and ask it to confirm receipt and a timeline. If it still misses the one-month deadline (as extended, where applicable) or refuses without a valid reason, you can complain to the Information Commissioner's Office (ICO), which can investigate and take enforcement action.
Does this tool store, send, or email my information anywhere?
No. The letter is assembled entirely in your browser as you type. Nothing you enter is saved, transmitted, or emailed by this tool. You copy or print the finished letter and send it yourself.
This tool generates a free self-help letter template based on the right of access under Article 15 of the UK GDPR. It is general information, not legal advice, and RecordingLaw.com is not a law firm and is not affiliated with the ICO or any UK government body. See ico.org.uk and gov.uk for the official guidance, or take independent legal advice for anything unusual or disputed.
Know someone who could use this? Share this free tool: